DMARC / SPF / DKIM Record Builder — Free Email Authentication DNS Record Generator

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS TXT record that tells receiving mail servers what to do when an email fails SPF or DKIM checks. It protects your domain from spoofing and phishing. Google and Yahoo require DMARC for bulk email senders since February 2024.

SPF (Sender Policy Framework) is a DNS TXT record listing which servers can send email for your domain. It uses mechanisms like include, ip4, ip6, a, and mx. Receiving servers check SPF to detect spoofing.

DKIM (DomainKeys Identified Mail) uses a DNS TXT record to publish a public key. The sending server signs emails with a private key, and receivers verify the signature against the public key in DNS, ensuring the message was not tampered with.

Completely free — no account, no subscription, no ads, no data collection. Unlike EasyDMARC, Dmarcian, or MxToolbox which require accounts or charge for features, this generates records entirely in your browser with no signup and no paywalls.

Yes. SPF verifies the sending server, DKIM verifies message integrity, and DMARC ties them together with a policy. All three are needed for maximum email security and deliverability.

Start with p=none to monitor without affecting delivery. After reviewing reports and confirming legitimate senders pass, move to p=quarantine, then p=reject for full protection.

Copy the generated record and add it as a TXT record in your DNS provider (Cloudflare, Route 53, GoDaddy, Namecheap, etc.). DMARC host: _dmarc. SPF host: @. DKIM host: selector._domainkey. Propagation takes minutes to 48 hours.

EasyDMARC and Dmarcian are full monitoring platforms with monthly fees. MxToolbox paywalls advanced features. This is a focused record builder — generates valid DNS records instantly with no account and no cost.

Alignment (adkim/aspf) controls how strictly the domain in the From: header must match the domain that signed with DKIM or authenticated with SPF. Relaxed (r, the default) allows organizational-domain matches, e.g. mail.example.com aligns with example.com. Strict (s) requires an exact match. Relaxed suits most setups; use strict when you need tighter control over exactly which subdomains can pass.

rua (aggregate reports) delivers a daily XML summary per sending source showing pass/fail counts — this is the report you actually want and should always configure. ruf (forensic reports) would send copies of individual failing messages, but almost no major mailbox provider still sends these for privacy reasons, so many domains omit it entirely. You can list multiple addresses separated by commas, and optionally cap the report size with an !10m style suffix.

Every include, a, mx, exists, and redirect mechanism costs one DNS lookup, and RFC 7208 caps SPF evaluation at 10 lookups total — going over causes a permerror and SPF fails closed. This tool counts lookups live with a progress meter and warns as you approach the limit. To fix an over-limit record: remove unused includes, replace an include with its underlying ip4/ip6 ranges (which don't count as lookups), or use an SPF-flattening service.

No. RFC 7208 requires exactly one SPF TXT record per domain — if a receiving server finds two, SPF returns a permerror and fails, even if both are individually valid. If you're combining providers (e.g. Google Workspace and a marketing platform), merge them into a single record with multiple include mechanisms rather than publishing two TXT records.

np sets the policy applied to mail claiming to come from a subdomain that doesn't actually exist in DNS — a common spoofing trick. It's part of the DMARCbis update to the DMARC standard. Leave it unset and non-existent subdomains fall back to your sp (subdomain policy) or main p policy; setting np=reject closes off a spoofing avenue that sp alone doesn't fully cover.

BIMI (Brand Indicators for Message Identification) displays your logo next to authenticated emails in supporting inboxes like Gmail and Yahoo. BIMI requires DMARC enforced at p=quarantine or p=reject — not none — covering all your mail, plus a separate BIMI DNS record pointing to your logo. DMARC is a prerequisite for BIMI, not an alternative to it.

DNS TXT records are limited to 255 characters per string, and DKIM public keys (especially 2048-bit RSA) routinely exceed that. Most DNS providers accept the value as several quoted strings that get concatenated automatically, like ("first255chars" "remainder"). This tool detects when your DKIM (or DMARC/SPF) record is over 255 characters and generates that split, DNS-ready format automatically, with its own copy button.

Yes. Paste an existing record into the Import Existing Record box in the sidebar and click "Parse & import" — the tool detects whether it's DMARC, SPF, or DKIM from its v= tag, switches to the matching tab, and fills in every field so you can review and adjust it visually instead of editing raw text.

No. Everything runs entirely in your browser — nothing you type is sent to any server. The only persistence is an autosave to your own browser's local storage, purely so your inputs survive a page reload; it never leaves your device, and no analytics event ever includes your domain or record contents.